Change AJV allErrors default and support user setting

[mdmower-csnw]

BREAKING CHANGE: Request and response validation stops after the first failure. Only one error will be reported even when multiple may exist. This follows best practices from AJV:

• Security risks of trusted schemas
• allErrors option

To report all validation errors (only recommended in development), option allErrors can be set in express-openapi-validator request and response validation options. For example:

app.use(
  OpenApiValidator.middleware({
    apiSpec: 'path/to/openapi.json',
    validateRequests: {
      allErrors: true,
    },
    validateResponses: {
      allErrors: true,
    },
  })
);

---

AJV security recommendations advise that allErrors should not be set to true in production (more details in #954). Update createAjv() so that it does not set allErrors by default and add support for letting users define allErrors in request and response validation options.

Added tests to ensure that the number of errors reported (when multiple are expected) is correct based on how allErrors is set (or unset).

The allErrors configuration for OpenAPISchemaValidator is not changed by this commit since that validation is for trusted content.

Fixes #954

[mdmower-csnw]

@cdimascio - couple of questions for this PR:

1. I opted to not introduce a breaking change by defaulting allErrors to true if not defined by the end user. Do you agree with this, or would you prefer to follow AJV's recommendation and default it to false?
2. Should I open a 2nd PR for the oas3.1 branch? Or do you plan to keep merging master into it over time?

[cdimascio]

@mdmower-csnw thanks for highlighting this and providing a fix. the ajv default is described as:

allErrors

Check all rules collecting all errors. Default is to return after the first error.

see ref

As a result, let's default to false following the security guidance and best practice

[mdmower-csnw]

Thanks for the quick response @cdimascio . Changes made and PR description updated.

[cdimascio]

@mdmower-csnw apologies for the multiple followups.

since this parameter allErrors impacts AJV behaviors, it should be available on both the request and response validator options i.e. validateRequests and validateResponses, rather than on root option object. These option objects configure each independently.

export interface OpenApiValidatorOpts {
  apiSpec: DeepImmutable<OpenAPIV3.Document> | string;
  validateApiSpec?: boolean;
  validateResponses?: boolean | ValidateResponseOpts;  // <--- In these opts
  validateRequests?: boolean | ValidateRequestOpts;  // <--- and these opts

Also, if you're up for it, it will be fantastic if you can also add the new option usages notes to the docs here

• validateRequests - https://github.com/cdimascio/express-openapi-validator-documentation/blob/main/docs/usage-validate-requests.md
• validateResponses - https://github.com/cdimascio/express-openapi-validator-documentation/blob/main/docs/usage-validate-responses.md

[mdmower-csnw]

Thanks @cdimascio, that makes sense. I've moved the option to request and response validation options and added tests for each. A PR for related documentation is at cdimascio/express-openapi-validator-documentation#1 .

[cdimascio]

Thank you!

[mdmower-csnw]

@cdimascio - could you check on the change history entry for this? https://github.com/cdimascio/express-openapi-validator/blob/master/CHANGE_HISTORY.md#2024-08-31 It doesn't look like the breaking change was recorded correctly.

Also, if this was released as version 5.3.4, the versions in the documentation could use an update: cdimascio/express-openapi-validator-documentation#1 (review)

[cdimascio]

Thanks will take a look